rockfish mcp

Enterprise license feature. The MCP server requires an Enterprise license.

Start an MCP (Model Context Protocol) server for AI-powered queries on Parquet data.

Overview

The MCP server exposes Parquet data to AI assistants and LLM toolchains using the Model Context Protocol. It provides query tools for data exploration and hunt tools for threat detection.

Usage

rockfish mcp [OPTIONS]

Transport Modes

Mode	Use Case
`stdio` (default)	Claude Desktop, local tool integration
`http`	Web clients, remote access

# stdio mode (default)
rockfish mcp

# HTTP mode
rockfish mcp -t http --host 0.0.0.0 --port 3000

Built-in Tools

Query Tools

Tool	Description
`query`	Query with SQL filters and column selection
`aggregate`	Group and aggregate data
`sample`	Get random sample rows
`count`	Count rows with optional filter
`schema`	Get column names and types
`list_sources`	List configured data sources

Hunt Tools

Tool	Description
`detect_beaconing`	Find C2 beacon patterns
`detect_lateral_movement`	Trace internal attack chains
`detect_c2_fanout`	Identify C2 fan-out patterns
`detect_port_scan`	Find port scanning activity
`detect_communities`	Discover botnet-like clusters
`detect_dns_tunneling`	Flag DNS tunneling indicators
`detect_data_exfiltration`	Find data exfiltration patterns

Options

Option	Default	Description
`-t, --transport`	`stdio`	Transport mode: `stdio` or `http`
`--data-dir`	from config	Override data directory
`--sensor`	from config	Override sensor name
`--no-hive`	—	Disable hive partitioning
`--host`	`127.0.0.1`	HTTP server host
`--port`	`3000`	HTTP server port

Authentication

HTTP mode supports JWT token authentication and OAuth2. See the MCP authentication documentation for configuration details.

Examples

# Start MCP server for Claude Desktop
rockfish mcp --data-dir /data/rockfish --sensor prod-01

# HTTP mode for web clients
rockfish mcp -t http --host 0.0.0.0 --port 3000 \
  --data-dir /data/rockfish --sensor prod-01

Keyboard shortcuts

Rockfish NDR Documentation